CVE-2026-18394 - Incorrect authorization in Strands Agents Tools http_request tool

What it is

CVE-2026-18394, an incorrect authorization flaw in the http_request tool of the strands-agents-tools package (pre-built tools for the open-source Strands Agents SDK). AWS bulletin 2026-069-AWS, published 07/31/2026. Affected versions are < 0.8.2; fixed in 0.8.2.

How it works

Operators bind a credential to approved hostnames via the HTTP_REQUEST_TOKEN_CONFIG allowlist so it is only sent to those hosts. But the tool also exposes a proxies parameter in its input schema that the LLM can set. An indirect prompt injection — e.g. delivered through untrusted web content the agent reads — sets proxies to an actor-controlled endpoint. The allowlist check still passes because it validates the request URL, not the proxy; the credential is attached and the first hop routes through the actor's proxy, disclosing it in cleartext in the Authorization header.

Preconditions / Affected

All of these must hold:

• strands-agents-tools < 0.8.2.
• A credential bound via HTTP_REQUEST_TOKEN_CONFIG.
• The http_request tool available to an agent that processes untrusted content (the injection vector).

flowchart TD
  A[Injected prompt sets proxies param] --> B{Allowlist checks URL only}
  B -->|proxy not validated| C[Credential attached]
  C --> D[First hop via actor proxy]
  D --> E[Authorization header leaked cleartext]
  B -.upgrade 0.8.2 / unset proxies out of band.-> X[Chain cut]

What to do

• Upgrade to strands-agents-tools 0.8.2 or later; patch any forked or derivative code.
• Rotate every credential configured via HTTP_REQUEST_TOKEN_CONFIG on affected versions, even with no evidence of exposure.

Interim workaround (beyond the summary's upgrade-and-rotate advice) if you cannot upgrade:

• Do not bind credentials with HTTP_REQUEST_TOKEN_CONFIG when http_request is exposed to an agent that processes untrusted content.
• Configure any required proxies out of band via the HTTP_PROXY and HTTPS_PROXY environment variables rather than through the tool's proxies parameter — this removes the LLM-controllable path.

Caveats

The credential rotation is precautionary; the page states there may be no indication a credential was exposed. The workaround only holds while the allowlist-plus-untrusted-content combination is avoided — it is a mitigation, not a fix; the code change in 0.8.2 is the actual remediation. Contact for questions is aws-security@amazon.com.